AI assistants: data minimisation starts with the first message
In brief
A financial AI assistant can receive more information than it needs, for example when a user attaches an account screenshot to a general question. According to Journal du Net, the first step is to establish which information each type of request truly requires. The CNIL defines minimisation as adequate, relevant data limited to the purpose pursued.
Source : Journal du Net - « Assistants IA financiers : limiter les données dès la première question »
What it changes for an SME
If you offer an AI assistant to customers or staff, GDPR requires you to collect only what each purpose needs. A general question should not lead to an account statement or unused attachments. Risk continues after the chat: copies sent to the model, technical logs, the support tool or evaluation datasets. According to the CNIL, retention depends on the purpose; one period for every conversation does not replace that justification.
What you can do
- From the first screen, separate general questions with no account data from file-related requests, and state which information is actually required.
- Put a reminder next to the input field not to send passwords, access codes or unrelated data, and disable attachments for general questions.
- Check the provider contract for access, model-training reuse and actual deletion, then test the full path with fictitious files, including logs and purge.
Let's talk about the time you could save.
In 20 minutes, we find where AI could save you time or money. Free, no commitment.